Subprocessors
We use the following third parties to operate the Service. Each subprocessor is bound by terms substantially equivalent to our own data-protection commitments. Where a subprocessor is located outside the European Economic Area (EEA), transfers of personal data are governed by the European Commission's Standard Contractual Clauses (Decision (EU) 2021/914) or another lawful transfer mechanism under Chapter V of the GDPR. We update this list when subprocessors are added, removed, or replaced. Customers under a Data Processing Agreement may register to receive advance notification of new subprocessors.
Active Subprocessors
| Provider | Function | Region | Data categories |
|---|---|---|---|
| Cloudflare, Inc. — R2 Storage | Object storage for generated PDF reports | European Union (R2 jurisdictional restriction: EU) | Generated PDF reports; storage object metadata |
| Cloudflare, Inc. — CDN | Content delivery, DDoS protection, TLS termination | Global edge network | HTTP request metadata (IP, headers, URL paths) |
| AI Inference Providers (including OpenAI, Inc. and others) | AI-based image analysis. Multiple providers may be used depending on workload routing and model availability. | United States and other regions; transfers governed by SCCs | Submitted images, processed transiently — see "Notes on Image Handling" below |
| Hosting Provider — [TO BE FINALIZED PRE-LAUNCH] | Server infrastructure for Admin Panel, Core API, and PDF rendering service | Netherlands or comparable EU jurisdiction | All operational data of the Service |
Planned Subprocessors
The following subprocessors are part of our planned roadmap and will be added when the corresponding feature goes live. This list is published in advance for transparency and to give Customers an opportunity to evaluate them.
| Provider | Function | Region | Status |
|---|---|---|---|
| CCBill, LLC | Payment processing for credit card transactions; merchant-of-record services where applicable | United States; transfers governed by SCCs | Planned — to be activated when live billing is enabled |
| Amazon Web Services EMEA SARL — Simple Email Service (SES) | Transactional email delivery (account verification, receipts, alerts, notifications) | European Union (eu-west-1 / eu-central-1) | Planned — to be activated with email-based notifications |
| PandaDoc, Inc. | Electronic signature for enterprise contracts (Agency Pro, API Production) | United States; transfers governed by SCCs | Planned — to be activated for B2B contract signing |
Self-Operated Infrastructure
Components of the Service that we operate directly are not subprocessors. The analysis service ("Core API") and the PDF rendering service ("CorePDF") are operated by [YOUR CYPRUS LTD LEGAL NAME] on infrastructure we control (hosted with the Hosting Provider listed above). The Core API orchestrates calls to AI inference subprocessors but does not itself perform the inference.
Notes on Image Handling by Subprocessors
Submitted images are forwarded to AI inference subprocessors solely for the duration of the analysis call and are not retained by the inference provider beyond what is technically required to process the request. Within our own infrastructure, original images are processed transiently and deleted immediately after analysis. Only the generated PDF report is delivered to the storage subprocessor (Cloudflare R2), and only for the applicable retention period.
Where AI inference subprocessors offer enterprise data-handling terms (such as zero-data-retention modes, no-training commitments, or EU data-residency options), we make use of those configurations where they are available and compatible with the Service.
Change Notification
We update this list when changes occur. Where a Customer under a Data Processing Agreement has registered for advance notice, we will provide notification of new subprocessors at least 30 days before they begin processing Customer data, by updating this page and (where the Customer has provided contact details for notifications) by email. The Customer's right to object on reasonable data-protection grounds is described in our Data Processing Agreement.